How this happens:
1. Hacker adds phone number to their own whatsapp. They do this to thousands/tens of thousands of phone numbers.
2. All of those phone numbers receive an SMS with the OTP to activate whatsapp. In that OTP, there's also a link that will activate whatsapp if you click it. "Enter code XXXXXX or click this link to activate whatsapp on your new phone"
3. Someone, somewhere eventually clicks that link.
4. Hackers take whatsapp account. Add two-factor authentication to it so that you can't take it back by reauthenticating normally.
5. Extortion.
People usually get it back by contacting whatsapp.
He said that he got a ton of SMS verification messages from WhatsApp and random phone calls from Argentina, Mexico and the US over the past few days that he was ignoring - not sure how they managed to bypass rate limiting on that.